How to strip down NTFS level security of cmd.exe down to only 'local admins' & 'system'

hello, 

for irs security requirements, need restrict access c:\windows\system32\cmd.exe web servers following:  

system: full control

local administrators: full control

but default cmd.exe inherits it's permissions parent.  so decided remove inheritance cmd.exe's ntfs permissions, , left behind 'system' & "local administrators' full control.  

boom!  'start run -- cmd' no longer works.  can't open/execute cmd.exe.  even thought logged in user local admin.  

after further testing, 'local users' (which domain users member of default when server joins ad ds domain) group absolutely required in order allow successful execution of cmd.exe.  of course particular ace inherited default - trying remove.  

why?  local admins there.  this wouldn't problem other file.  why system file acting differently?  

thanks in advance! 

hi,

thanks post.

please check permission below when grant related permission users.

https://msdn.microsoft.com/en-us/library/bb219237%28v=cs.70%29.aspx?f=255&mspperror=-2147217396

in addition, please temporarily disable uac do a test after grant permission.

best regards,

mary

---

please remember mark replies answers if help.
if have feedback technet subscriber support, contact tnmff@microsoft.com.

Windows Server  >  Security